{
  "id": 6680870,
  "title": "The Deny Rule I Wrote Was Never Consulted",
  "url": "https://urgent.news/2026/09/11/the-deny-rule-i-wrote-was-never-consulted",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-11T01:03:22.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/quintetkit/the-deny-rule-i-wrote-was-never-consulted-olp"
  },
  "original_language": "en",
  "account": "The denied rule for writing files in the generated directory was never consulted, even though it was valid and loaded. The rule applied to Read() and Edit() operations, but not to Write() as intended. The issue arose because the startup warning was not being read, even though it was present every time the rule was loaded. Additionally, a Bash script using the wildcard (*) allowed a range of git commands, including git push origin main, which was not intended. The rule also permitted commands like git -c core.pager=… diff main, which could run arbitrary programs. Furthermore, an unanchored allow glob and a parameter rule on a tool's own content field were ignored. The lesson learned was that a permission rule that does nothing can appear to be working, as both silent states are identical. The configuration checker, npx @quintetkit/ccheck warn .claude/settings.json, confirmed that the rule was accepted but never applied.",
  "summary": "I had a rule meant to keep an agent inside one directory: { \"permissions\" : { \"deny\" : [ \"Write(src/generated/**)\" ] } } It is valid. It loads. It is never consulted. File path rules apply to Read(...) and Edit(...) . Written for Write , NotebookEdit , Glob , or the legacy MultiEdit , the rule is accepted and then never looked at. There is a startup warning; I had not been reading startup output,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}